getent passwdlists every account, including any from LDAP or other directory services that /etc/passwd will not show.- Human accounts almost always have a UID of 1000 or above. Below that are system accounts.
whoshows who is logged in right now;lastshows who has logged in recently.- An account with a shell of /usr/sbin/nologin cannot log in interactively, which is how service accounts should be configured.
- The accounts worth auditing are the ones that can log in and have sudo, not the long list of system users.
How do I list all users on a Linux system?
Use getent passwd. It returns every account the system knows about, which on a plain server is the contents of /etc/passwd, and on a server joined to a directory service also includes accounts from there. Reading /etc/passwd directly misses those.
# Every account, full detail
getent passwd
# Just the usernames
getent passwd | cut -d: -f1
# Sorted, one per line
getent passwd | cut -d: -f1 | sort
# How many accounts exist in total
getent passwd | wc -l
# Does one specific account exist?
getent passwd alicegetent passwd alice exits 0 if the account exists and 2 if it does not, so it works in a script without parsing output.$ getent passwd deploy
deploy:x:1001:1001:Deploy user:/home/deploy:/bin/bash
| | | | | | |
| | | | | | +-- login shell
| | | | | +------------ home directory
| | | | +-------------------------- description
| | | +------------------------------------ primary group ID
| | +----------------------------------------- user ID (UID)
| +-------------------------------------------- password placeholder
+------------------------------------------------- usernameHow do I list only human users, not system accounts?
A fresh server has thirty to forty accounts and none of them are people. Services get their own account so they can run without root. The convention is that system accounts take UIDs below 1000 and human accounts start at 1000, so filtering on UID gives you the list you actually wanted.
# Accounts with UID 1000 or above: the humans
getent passwd | awk -F: '$3 >= 1000 && $3 < 65534 {print $1}'
# With UID and home directory, formatted
getent passwd | awk -F: '$3 >= 1000 && $3 < 65534 {printf "%-16s %-6s %s\n", $1, $3, $6}'
# The more useful question: who can actually log in?
getent passwd | grep -vE '(nologin|/bin/false)$' | cut -d: -f1,3,7nobody account, which sits at the top of the range and is not a person either.| UID range | What lives there |
|---|---|
| 0 | root |
| 1 to 999 | System and service accounts: www-data, sshd, mysql |
| 1000 and up | Human accounts, created in order |
| 65534 | nobody, the unprivileged fallback |
On older RHEL systems the human range starts at 500 rather than 1000. Check /etc/login.defs for UID_MIN if it matters.
The shell field is the real signal
An account with /usr/sbin/nologin or /bin/false cannot start an interactive session, whatever its UID. That is how a service account should look. A system account with /bin/bash is worth a second look, because it does not need one.
How do I see who is logged in right now?
# Who is logged in, from where, since when
who
# Same, plus what each session is running and system load
w
# Just the usernames, deduplicated
users
# Your own effective username
whoami
# Full identity: UID, primary group, every secondary group
idw is the one to run first: it shows idle time and the current command, so you can tell an active session from one someone left open on Friday.# Recent logins, most recent first
last
# One user's history
last alice
# Failed login attempts (needs root)
sudo lastb | head -30
# When did each account last log in at all?
lastlog
# Accounts that have never logged in
lastlog | grep 'Never logged in'lastlog covers every account in one table, which makes it the fastest way to find dormant accounts.Thousands of failed logins is normal, and still worth reading
Any server with SSH exposed to the internet sees constant automated password guessing, which you will also see in the authentication logs. The volume is not the interesting part. What matters is whether any of them succeeded, and whether they targeted a username that actually exists. Disable password authentication entirely and the whole category stops mattering.
How do I audit which users have root access?
This is the list that matters. Not who exists, but who can become root. Group membership is how most of that access is granted, so adding and removing users from groups is the other half of this job. There are more routes than the sudo group, and two of them are easy to miss.
# 1. Members of the sudo group (Debian/Ubuntu) or wheel (RHEL family)
getent group sudo
getent group wheel
# 2. Rules granted directly in sudoers, including drop-in files
sudo grep -rE '^[^#]*ALL' /etc/sudoers /etc/sudoers.d/
# 3. Any account with UID 0. There should be exactly one: root.
awk -F: '$3 == 0 {print $1}' /etc/passwd
# 4. Members of the docker group, which is root in practice
getent group docker
# What a specific user can run as root
sudo -lU alice| Check | Command | What you want to see |
|---|---|---|
| Accounts with UID 0 | awk -F: '$3 == 0' /etc/passwd | Only root |
| Sudo group members | getent group sudo | Named people you recognise |
| Passwordless sudo | grep NOPASSWD /etc/sudoers.d/* | Automation accounts only |
| Docker group | getent group docker | Treat every member as root |
| Accounts with no password set | sudo awk -F: '$2 == ""' /etc/shadow | Nothing at all |
Run these on any server you have inherited, before you change anything else on it.
Dormant accounts are the ones that get compromised, because nobody notices the login. lastlog | grep 'Never logged in' finds accounts created and forgotten. Lock them with sudo usermod -L username rather than deleting, so their files keep a recognisable owner.
How do I find out what a user can access?
# Identity and every group
id alice
# What sudo rights they have
sudo -lU alice
# Account status: L locked, P has a password, NP no password
sudo passwd -S alice
# Password and account expiry
sudo chage -l alice
# Files they own outside their own home directory
sudo find / -user alice -not -path '/home/alice/*' -ls 2>/dev/null | head -30
# Their authorised SSH keys
sudo cat /home/alice/.ssh/authorized_keysCheck authorized_keys on every account, not just theirs
A leaver's public key may have been added to a shared deploy account as well as their own. sudo grep -rl 'their-key-comment' /home/*/.ssh/authorized_keys /root/.ssh/authorized_keys finds every copy. Removing the user account alone does not.
Once you know who exists and what they can reach, the next question is what the permissions on the files themselves allow. Understanding Linux users, groups and file permissions covers the model end to end. If managing server accounts is not something you want to own, our managed hosting keeps the operating system layer out of your hands entirely.
Frequently asked questions
What is the command to list all users in Linux?
getent passwd lists every account the system knows about, including any provided by LDAP or another directory service. For just the names, pipe it: getent passwd | cut -d: -f1. Reading /etc/passwd directly works on a standalone server but misses directory-provided accounts.
How do I list only real user accounts and not system accounts?
Filter by user ID: getent passwd | awk -F: '$3 >= 1000 && $3 < 65534 {print $1}'. By convention, accounts numbered below 1000 belong to services and accounts from 1000 upward belong to people. Some older RHEL systems start the human range at 500.
What is the difference between who, w and last?
who lists sessions open right now. w does the same and adds idle time, current command and system load. last reads the login history from /var/log/wtmp and shows sessions that have already ended, including reboots.
How can I tell which users have sudo access?
Start with getent group sudo on Debian and Ubuntu, or getent group wheel on the RHEL family. Then check for direct grants with sudo grep -rE '^[^#]*ALL' /etc/sudoers /etc/sudoers.d/, and confirm no second account has UID 0. sudo -lU username shows what one specific user can run.
How do I see when a user last logged in?
lastlog prints the most recent login for every account in one table, including "Never logged in" for dormant ones. For a full history of one account, last username lists each session with its start time and duration.
About G7Cloud Engineering
Articles written by the engineers who build and run G7Cloud: UK managed hosting and the AI Website Builder. We write about what we operate every day: containers, backups, databases, and the small-business websites that run on them.
More about G7Cloud →
